Fix path traversal for "/.." (#680)

ZipArchive · Jul 22, 2023 · 49a22a5 · 49a22a5
1 parent b56f8c6
commit 49a22a5
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/Example/ObjectiveCExampleTests/SSZipArchiveTests.m b/Example/ObjectiveCExampleTests/SSZipArchiveTests.m
@@ -637,6 +637,8 @@ - (void)testPathSanitation {
       @"..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\tmp\\test.txt": @"tmp/test.txt",
       // relative path
       @"a/b/../c.txt": @"a/c.txt",
+      // path traversal with slash (#680)
+      @"/..": @"",
       // path traversal without slash
       @"..": @"",
       // permissions override

diff --git a/Example/ZipArchiveExample.xcodeproj/project.pbxproj b/Example/ZipArchiveExample.xcodeproj/project.pbxproj
@@ -1177,6 +1177,7 @@
 				CODE_SIGN_IDENTITY = "-";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
+				DEAD_CODE_STRIPPING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu99;
 				INFOPLIST_FILE = SwiftExample_macOS/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
@@ -1238,6 +1239,7 @@
 				CODE_SIGN_IDENTITY = "-";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
+				DEAD_CODE_STRIPPING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
 				INFOPLIST_FILE = ObjectiveCExampleTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/../Frameworks";

diff --git a/SSZipArchive/SSZipArchive.m b/SSZipArchive/SSZipArchive.m
@@ -1448,7 +1448,7 @@ - (NSString *)_sanitizedPath
     strPath = [NSURL URLWithString:strPath].standardizedURL.absoluteString;
 
     // Remove the "file:///" scheme
-    strPath = [strPath substringFromIndex:8];
+    strPath = strPath.length < 8 ? @"" : [strPath substringFromIndex:8];
 
     // Remove the percent-encoding
 #if (__MAC_OS_X_VERSION_MIN_REQUIRED >= 1090 || __IPHONE_OS_VERSION_MIN_REQUIRED >= 70000 || __WATCH_OS_VERSION_MIN_REQUIRED >= 20000 || __TV_OS_VERSION_MIN_REQUIRED >= 90000)